Taking advantage of CSP we can detect whether URL1 does redirect to URL2 and even bruteforce /path of URL2/path. This is a conceptual vulnerability in CSP design, and there’s no obvious way to fix it. CSP header tells browsers what scripts and/or 3rd party scripts can be loaded/executed for this page. Chrome 16+ Safari 6+ and Firefox 4+ support CSP, IE 10 has very limited support. Using 100-500 most popular FB clients we can build sort of user’s fingerprint: what apps you authorize and what websites you frequently visit.”]
Source: http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html